Invisible crypto: inform users about changes to other users' cryptographic identity

[richvdh]

As part of the Trust and decorations work, we want to show users when somebody in a room changes their identity (ie, Master cross-signing key).

There are three two three four parts to this work:

1. Invisible crypto: display a warning when a verified user changes identity #2492
2. Invisible crypto: Put a marker in the timeline that shows when a user's identity changed #2493
3. [Story] Banner for unverified user identity change #2544
   a. [ ] Invisible Crypto: Rust for EX: display a warning when an *unverified* user changes identity #2526
   c. [ ] Invisible Crypto: EX iOS: display a warning when an *unverified* user changes identity #2525
   d. [ ] Invisible Crypto: EX Android: display a warning when an *unverified* user changes identity #2524
4. Invisible Crypto: Web: display a warning when an *unverified* user changes identity #2513
5. Require acknowledgement to send to a verified user if their identity changed or a device is unverified element-web#27943
6. Invisible crypto: allow the user to review recent changes to other users' identities #2494

[richvdh]

Notes from a design meeting today:

• There is probably no need for a warning banner (Invisible crypto: display a warning when a verified user changes identity #2492) when an unverified user replaces their identity -- in other words, as soon as we see the new identity we replace it.
• The in-timeline notice for identity changes (Invisible crypto: Put a marker in the timeline that shows when a user's identity changed #2493) could do with being more emphasised than just a nick change, but not highlighted in red.
• Do we want the same timeline notices for verified and unverified users? Probably the same styling but slightly different wording.
• What happens if there are multiple verified users with new identities? For now, we probably just queue them up, but eventually maybe we want to expose a modal where you can review the affected users, or something.
• Do we need the "Verify again" button?
  • Most of the time you won't be in a position to re-verify, so it's a bit useless
  • but we need something other than just "withdraw verification"
  • maybe it should be "go to profile"?

[richvdh]

More notes:

• Invisible crypto: Put a marker in the timeline that shows when a user's identity changed #2493 is involved. In the meantime we'll have to display a warning banner for unverified users: Invisible Crypto: Web: display a warning when an *unverified* user changes identity #2513 covers this